KV plugin leaves starting bracket in key

Just found a difference after upgrade logstash to v6.2.3.

sample data:

{{key1=value1}{key2=value2}}

config:

kv {
  field_split => "\{\}"
}

expected output:

key1 => value1
key2 => value2

But after upgrade, it outputs like:

{key1 => value1
{key2 => value2

Tested on standalone logstash v6.2.2, it works fine as expected.
kv plugin version in logstash 6.2.2 is 4.0.3
in logstash 6.2.3 it is 4.1.0

Currently I am using remove_char_key => "{" as a workaround.

Even update kv plugin version to v4.1.1 (latest) doesn't help.

Have you tried the new regex option? This was added in 4.1.0.
It should be able to get this right:
https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-field_split_pattern

Hi @Mojster thank you for suggestion.
I've tried on logstash v6.2.3 w/ kv plugin v4.1.1 like following:

kv {
  field_split_pattern => "[\{+\}+]"
}

But it still cannot remove the start bracket.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.